feat(rabbitmq): expose the management UI on the tailnet (#55) #77

Merged

tepichord merged 1 commit from feat/rabbitmq-ingress into main

2026-09-21 08:06:52 -07:00

tepichord commented

2026-09-21 07:40:44 -07:00

Owner

An Ingress on the shared ingress-proxies ProxyGroup puts the UI at
rabbitmq.faun-snapper.ts.net, and its backend is the management port, 15672 —
not 5672, which is amqp and cannot answer an HTTP request, so aiming there would
read as a proxy fault rather than a wrong port.

The ProxyGroup is not decoration: this namespace enforces baseline and the
proxy runs in the tailscale namespace, so a per-Ingress proxy pod placed here
would be rejected.

Two guards come with it. One holds the Ingress to the management port, the
ProxyGroup and the MagicDNS label; the other holds the cluster-wide one-name-one
-Ingress rule, which is silent when broken because both Ingresses are valid and
the operator reconciles both. §16d records the exposure and the one admin-console
approval it needs, same as every other name off that ProxyGroup.

An Ingress on the shared ingress-proxies ProxyGroup puts the UI at rabbitmq.faun-snapper.ts.net, and its backend is the `management` port, 15672 — not 5672, which is amqp and cannot answer an HTTP request, so aiming there would read as a proxy fault rather than a wrong port. The ProxyGroup is not decoration: this namespace enforces `baseline` and the proxy runs in the `tailscale` namespace, so a per-Ingress proxy pod placed here would be rejected. Two guards come with it. One holds the Ingress to the management port, the ProxyGroup and the MagicDNS label; the other holds the cluster-wide one-name-one -Ingress rule, which is silent when broken because both Ingresses are valid and the operator reconciles both. §16d records the exposure and the one admin-console approval it needs, same as every other name off that ProxyGroup.

tepichord added 1 commit

2026-09-21 07:40:44 -07:00

feat(rabbitmq): expose the management UI on the tailnet (#55 )

ci/woodpecker/pr/gates Pipeline was successful

Details

ci/woodpecker/pull_request_closed/cleanup Pipeline was successful

Details

a6e5bffa98

An Ingress on the shared ingress-proxies ProxyGroup puts the UI at
rabbitmq.faun-snapper.ts.net, and its backend is the `management` port, 15672 —
not 5672, which is amqp and cannot answer an HTTP request, so aiming there would
read as a proxy fault rather than a wrong port.

The ProxyGroup is not decoration: this namespace enforces `baseline` and the
proxy runs in the `tailscale` namespace, so a per-Ingress proxy pod placed here
would be rejected.

Two guards come with it. One holds the Ingress to the management port, the
ProxyGroup and the MagicDNS label; the other holds the cluster-wide one-name-one
-Ingress rule, which is silent when broken because both Ingresses are valid and
the operator reconciles both. §16d records the exposure and the one admin-console
approval it needs, same as every other name off that ProxyGroup.